Arch Linux Security Advisory ASA-202102-2 ========================================= Severity: High Date : 2021-02-06 CVE-ID : CVE-2020-15685 CVE-2020-26976 CVE-2021-23953 CVE-2021-23954 CVE-2021-23960 CVE-2021-23964 Package : thunderbird Type : multiple issues Remote : Yes Link : https://security.archlinux.org/AVG-1496 Summary ======= The package thunderbird before version 78.7.0-1 is vulnerable to multiple issues including arbitrary code execution, information disclosure and insufficient validation. Resolution ========== Upgrade to 78.7.0-1. # pacman -Syu "thunderbird>=78.7.0-1" The problems have been fixed upstream in version 78.7.0. Workaround ========== None. Description =========== - CVE-2020-15685 (insufficient validation) A security issue was found in Thunderbird before version 78.7. During the plaintext phase of the STARTTLS connection setup, protocol commands could have been injected and evaluated within the encrypted session. - CVE-2020-26976 (information disclosure) A security issue was found in Firefox before 84.0. When an HTTPS page was embedded in an HTTP page, and there was a service worker registered for the former, the service worker could have intercepted the request for the secure page despite the iframe not being a secure context due to the (insecure) framing. - CVE-2021-23953 (information disclosure) A security issue was found in Firefox before version 85.0 and Thunderbird before version 78.7. If a user clicked into a specifically crafted PDF, the PDF reader could be confused into leaking cross-origin information, when said information is served as chunked data. - CVE-2021-23954 (arbitrary code execution) A security issue was found in Firefox before version 85.0 and Thunderbird before version 78.7. Using the new logical assignment operators in a JavaScript switch statement could have caused a type confusion, leading to a memory corruption and a potentially exploitable crash. - CVE-2021-23960 (arbitrary code execution) A security issue was found in Firefox before version 85.0 and Thunderbird before version 78.7. Performing garbage collection on re- declared JavaScript variables resulted in a use-after-poison, and a potentially exploitable crash. - CVE-2021-23964 (arbitrary code execution) A security issue was found in Firefox before version 85.0 and Thunderbird before version 78.7. Mozilla developers reported memory safety bugs present in Firefox 84 and Firefox ESR 78.6. Some of these bugs showed evidence of memory corruption and Mozilla presumes that with enough effort some of these could have been exploited to run arbitrary code. Impact ====== A remote attacker might be able to access sensitive information or execute arbitrary code. In addition, an attacker in position of man-in- the-middle might be able to inject an IMAP response into a secure communication channel with the server. References ========== https://www.mozilla.org/en-US/security/advisories/mfsa2021-05/#CVE-2020-1568... https://bugzilla.mozilla.org/show_bug.cgi?id=1622640 https://www.mozilla.org/en-US/security/advisories/mfsa2020-54/#CVE-2020-2697... https://bugzilla.mozilla.org/show_bug.cgi?id=1674343 https://www.mozilla.org/en-US/security/advisories/mfsa2021-03/#CVE-2021-2395... https://www.mozilla.org/en-US/security/advisories/mfsa2021-05/#CVE-2021-2395... https://bugzilla.mozilla.org/show_bug.cgi?id=1683940 https://www.mozilla.org/en-US/security/advisories/mfsa2021-03/#CVE-2021-2395... https://www.mozilla.org/en-US/security/advisories/mfsa2021-05/#CVE-2021-2395... https://bugzilla.mozilla.org/show_bug.cgi?id=1684020 https://www.mozilla.org/en-US/security/advisories/mfsa2021-03/#CVE-2021-2396... https://www.mozilla.org/en-US/security/advisories/mfsa2021-05/#CVE-2021-2396... https://bugzilla.mozilla.org/show_bug.cgi?id=1675755 https://www.mozilla.org/en-US/security/advisories/mfsa2021-03/#CVE-2021-2396... https://www.mozilla.org/en-US/security/advisories/mfsa2021-05/#CVE-2021-2396... https://bugzilla.mozilla.org/buglist.cgi?bug_id=1662507%2C1666285%2C1673526%... https://security.archlinux.org/CVE-2020-15685 https://security.archlinux.org/CVE-2020-26976 https://security.archlinux.org/CVE-2021-23953 https://security.archlinux.org/CVE-2021-23954 https://security.archlinux.org/CVE-2021-23960 https://security.archlinux.org/CVE-2021-23964